[SOLVED] About email lost

[Max Ma]

Dear Sir,

I have just have a Zimbra upgrade to 4.5.7 but then I have found in the pass two days, most of the user have their email before 28th Aug have been removed for some reason.

I am not sure what may cause the problem, still looking for the problem
Can any one help?
And I do have some back up aslo backup for 4.5.6 before the upgrade

[jholder]

Can you please do a
su - zimbra
zmprov getAccount (account name) | grep zimbraMailMessageLifetime

and post the results

[Max Ma]

Dear Jholder,
Here is the result
All users are
zimbraMailMessageLifetime: 2h

What have done.
Anyway to get the message back

[jholder]

Oh man-
That's not good.

You need to reset that value to 0.
zmprov getAccout (account) zimbraMessageLifetime 0

As for how that got set, I don't know. Did you do it? I got worried, and tested a 4.5.6 upgrade to 4.5.7 and it didn't happen.

At this point the only way to get your messages back is to restore your old install, and get them out using a pop3 or IMAP client. Then restore and push the messages back.

john

[mmorse]

Ya 2 hrs ain't a good value for the amount of time an email can remain in any folder...your loosing content by the second...
a) might want to shutdown and provision via ldap - better that the mail just queues up on the senders servers (or on a backup mx if you have one)
or
b) quickly fix that attribute; I'd also recommend checking your COS values first-and see if that filters down (/reset the uses to the cos value) as it'll save you time (& time later if you ever change it again).
user/individual cos > advanced tab > at the bottom

Your fastest way to get operational again once you've done a/b above:
-might as well make a full backup of the 4.5.7 so you can dig through logs & the remaining 2hrs worth of email
-if it's not that many users & small mailbox size from the past 2hrs - fire up thunderbird (with /tb on the end of the username) and copy the recent mail to local
(the same could be accomplished if you fired up another zcs install and imapsynced)
-restore 4.5.6
-upgrade 4.5.7
-work on getting the recent mail - fire up a 2nd box with your 4.6.7 backup (or thunderbird if you had less users)

Were you possibly trying to set the junk or trash lifetimes?
Email message lifetime - Number of days a message can remain in any folder before it is automatically purged. The default is 0; email messages are not deleted.
Trashed message lifetime - Number of days a message remains in the Trash folder before it is automatically purged. The default is 30 days.
Spam message lifetime - Number of days a message can remain in the Junk folder before it is automatically purged. The default is 30 days.

Originally Posted by jholder

You need to reset that value to 0.
zmprov getAccout (account) zimbraMessageLifetime 0

change 'get' to 'modify' & add a 'u'

zmprov ma user@domain.com zimbraMessageLifetime 0
OR
zmprov modifyAccount user@domain.com zimbraMessageLifetime 0

[Max Ma]

Dear Jholder,

thanks for your information. I am not sure who did it. Is there any way I can check from the way log.
I will have to do the restore then.


Many thanks

[jholder]

mmorse is correct. It's modify account.

Also, since your max message lifetime is so short, I would advise you to stop zimbra, and run zmprov with the -l switch.

If you belive this was an upgrade issue, any information you can provide about your system would be helpful.

[jholder]

Originally Posted by Max Ma

Dear Jholder,

thanks for your information. I am not sure who did it. Is there any way I can check from the way log.
I will have to do the restore then.


Many thanks

Your mailbox.log should log admin requests of that nature. It'll have a UID next to it, but you should be able to narrow it down.

Best of luck,
john

[mmorse]

Originally Posted by Max Ma

thanks for your information. I am not sure who did it. Is there any way I can check from the way log.

start with: /opt/zimbra/log/audit.log & mailbox.log

logfile list:/docs/ne/latest/administration_guide/9_Monitoring.12.1.html#1075561

Originally Posted by jholder

mmorse is correct. It's modify account.

just keeping ya on your toes

[Max Ma]

Thanks you a lot both of yours.